Pitchesto // LEGAL SPECIFICATION
Privacy Policy
1. Who we are
This Privacy Policy describes how Pitchesto (“Pitchesto,” “we,” “us,” or “our”) handles information in connection with our websites, applications, and related services (collectively, the “Service”).
For privacy questions, contact privacy@pitchesto.com. Product support is available at support@pitchesto.com or through in-product channels when enabled.
Controller / operator details (legal entity name, registered address) should be completed by counsel before public launch.
2. Scope
This Policy applies to:
- Visitors to our marketing site and legal pages
- Users who create accounts and workspaces
- Data processed when you run discovery, deep research, website generation, QA, billing, inbox, or hosting features
- Information related to client payment flows you initiate through Stripe Connect
It does not control privacy practices of third-party websites you research, client websites you publish, or payment pages hosted by Stripe. Those parties have their own policies.
3. Information we collect
3.1 Account and identity
- Email address, display name, and authentication identifiers from Firebase Authentication (including Google sign-in when you choose it)
- Session credentials stored in a first-party session cookie used to keep you signed in
- Invite / onboarding status and workspace membership role (for example owner or member)
3.2 Workspace and collaboration
- Workspace name and settings
- Team membership and invitations
- Role-based access records for projects and client portals when those features are used
3.3 Prospect, discovery, and research data
- Search queries, locations, categories, and filters you enter
- Business names, addresses, phone numbers, websites, emails, social links, and other attributes returned or recovered during discovery/research
- Provenance notes, confidence scores, ranking signals, screenshots, and structured research reports
- Your notes, pipeline stage, and pursuit decisions about prospects
Much of this information concerns businesses (commercial entities). Where it identifies a natural person (for example a sole proprietor’s name or personal email), we treat it as personal data under applicable law.
3.4 Website drafts, demos, and deliverables
- Business briefs, brand inputs, content drafts, design plans, and structured page data
- Preview and share tokens, presentation links, proposals, and handover records
- Hosting configuration, custom domains, and published site metadata when hosting is enabled
3.5 Billing and payments
- Platform subscription status, plan selection, and Stripe customer / subscription identifiers for your Pitchesto subscription
- For client payments: payment request metadata, amounts, status, and Stripe Connect account identifiers — card numbers are processed by Stripe and are not stored in Pitchesto systems as full PAN data
- Usage and quota counters used for plan entitlements and cost controls
3.6 Technical and operations data
- IP address, browser/user-agent, device type, timestamps, and approximate location derived from network data
- Application logs, error reports, feature flags, and health checks
- Security events (failed auth, webhook processing, rate limits)
3.7 Communications
- Support messages, feedback, and email you send us
- Transactional messages we send (invites, billing receipts via Stripe, operational notices)
4. Sources of information
- You and your workspace. Information you enter, upload, import, or generate while using the Service.
- Public and semi-public web sources. Discovery and research features may query publicly available pages and search results via providers such as OpenAI web search (and optional legacy crawlers when enabled) to recover business websites, contact details, and activity signals.
- Authentication providers. Firebase / Google provide identity assertions when you sign in.
- Payment processors. Stripe provides payment and Connect status updates via webhooks.
- Hosting / infrastructure. Vercel, database, and storage providers process technical data needed to run the Service.
5. How we use information
We use information to:
- Provide, operate, secure, and improve the Service
- Authenticate users and enforce workspace permissions
- Run discovery, research, ranking, website generation, quality checks, and previews
- Enable pitching, proposals, share links, client portals, and handover workflows
- Process platform subscriptions and support Stripe Connect client payments you initiate
- Enforce plan limits, prevent abuse, and investigate security incidents
- Send transactional and service-related communications
- Comply with law, enforce our Terms and Acceptable Use Policy, and respond to lawful requests
- Create de-identified or aggregated metrics that do not reasonably identify you
We do not sell prospect lists or workspace customer lists as a product. We do not use prospect research data to cold-email businesses on your behalf without your direction inside the product workflows you control.
6. AI and automated processing
Pitchesto uses machine learning and automated systems (including large language models and vision models via providers such as OpenAI, and optionally other model gateways when configured) to:
- Search and summarize public web information about businesses
- Structure research findings and recommend pursuit priority
- Generate website copy, layout plans, and related creative drafts
- Analyze screenshots or page captures for visual quality and content signals
- Assist QA and operational checks
Model outputs can be incomplete, outdated, or incorrect. You are responsible for verifying facts before pitching, publishing, or representing a site as approved by a business. Providers may process prompts and context under their terms; see our Subprocessors list.
Where required by law, you may have rights related to automated decision-making. Ranking and lead scoring insidePitchesto are decision-support tools for your sales workflow, not consumer credit, employment, or housing decisions.
8. International transfers
We and our subprocessors may process information in the United States and other countries. Those countries may have different data-protection laws than your home jurisdiction. Where required, we rely on appropriate transfer mechanisms (such as standard contractual clauses) implemented by us or our providers. Counsel should confirm transfer documentation before serving EEA/UK users at scale.
9. Retention
We retain information for as long as needed to provide the Service and for legitimate business purposes, including:
- Account and workspace records while the account remains active
- Prospect, research, project, and billing records associated with your workspace
- Security and webhook logs for a limited period needed for integrity and dispute resolution
- Information retained when required by law (for example tax or accounting records)
When you delete content or close a workspace, we delete or de-identify data within a commercially reasonable period, except where backups, legal holds, or shared artifacts (for example a link already opened by a recipient) require longer retention. Residual copies in encrypted backups are removed on normal backup rotation.
10. Security
We implement technical and organizational measures appropriate to the nature of the Service, including encrypted transport (HTTPS), access controls, session cookie authentication, secrets handling for server credentials, and least-privilege patterns in application code. No method of transmission or storage is 100% secure. You are responsible for protecting account credentials and for configuring share links carefully.
11. Your rights and choices
Depending on your location, you may have rights to:
- Access and receive a copy of personal data we hold about you
- Correct inaccurate personal data
- Delete personal data (subject to legal exceptions)
- Export workspace content where the product provides export/portability features
- Object to or restrict certain processing
- Withdraw consent where processing is consent-based
- Opt out of “sale” or “sharing” for cross-context behavioral advertising if we ever engage in such activity (we do not currently sell personal information)
To exercise rights, email privacy@pitchesto.com. We may need to verify your identity and workspace authority. Authorized agents may submit requests where permitted by law.
Cookie and similar technology controls are described in our Cookie Policy.
If you are in the EEA/UK, you may also lodge a complaint with your local supervisory authority. If you are a California resident, you may have additional rights under the CCPA/CPRA; we will not discriminate against you for exercising those rights.
12. Children
The Service is built for business users and is not directed to children under 16 (or a higher age required by local law). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.
13. Demonstrations and samples
Sample foundations (for example the fictional restaurant preview) and private demos you generate are tools for sales conversations. Unless a business has approved publication, demos must not be presented as that business’s official website. Labels such as “Sample” or “unofficial demonstration” exist to reduce confusion; you remain responsible for how you present demos to prospects.
14. Business customers and processors
If you use Pitchesto on behalf of a company, you represent that you are authorized to do so. For personal data you upload about your clients, employees, or prospects, you are typically the controller (or equivalent) and Pitchesto acts as a processor / service provider to the extent required by applicable law. A Data Processing Addendum may be made available on request for enterprise customers.
15. Changes
We may update this Policy from time to time. We will revise the effective date above and, for material changes, provide additional notice (for example in-product or by email) where required. Continued use after the effective date constitutes acceptance of the updated Policy to the extent permitted by law.
16. Contact
Privacy requests: privacy@pitchesto.com
Support: support@pitchesto.com
Mailing address and data protection officer (if appointed) to be completed by counsel.